Top Risks

• jQuery 3.2.1 bundled with 3 medium-severity CVEs (XSS); version below fixed_in 3.5.0
• Privacy policy on CDN domain (cdn.cloudapi.stream), scope_extension=false; generic non-scoped policy
• Developer is free-webmail Gmail account with no verified business identity
• Sandbox CSP allows unsafe-inline and unsafe-eval on script-src in sandboxed pages
• 12 external JS hosts referenced in code despite no declared host_permissions — scope unclear

Evidence

• cve_jquery_medium_x3 crx jquery@3.2.1 has CVE-2019-11358, CVE-2020-11022, CVE-2020-11023; all medium severity; fixed in 3.5.0
• privacy_policy_generic_cdn store Policy at cdn.cloudapi.stream; scope_extension=false, data_collection=false, third_party_sharing=true
• developer_free_webmail store Dev email kiev3381917@gmail.com; no verified publisher; no business domain
• sandbox_csp_unsafe manifest Sandbox CSP includes unsafe-inline and unsafe-eval on script-src; main extension pages CSP is strict
• js_external_hosts_12 crx 12 external hosts in JS files including bnjmnt4n.now.sh, goo.gl, createjs.com; no host_permissions declared
• low_installs store Only 108 installs; tail-attack-surface anomaly not flagged but low footprint limits blast radius
• maintenance_3_6mo store Last updated April 20, 2026; 4 months since update — minor staleness penalty applied
• no_code_obfuscation crx obfuscation_score=0.0; code_findings_raw empty; no active exfil or eval signals detected

CVE Exposures (3)

Pillar Scores

Bookkeeping